4423f1800d84f522ce7f286a74655ced083aacdc887e2ce17152bd8b0340df02

Analysis

max time kernel
142s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 10:23

Target

ed32980f109944f73f6f7fe180c449b6_JaffaCakes118.dll
Size

68KB
MD5

ed32980f109944f73f6f7fe180c449b6
SHA1

56cf44ddf86dc733480fcc3aadae656420ff7154
SHA256

4423f1800d84f522ce7f286a74655ced083aacdc887e2ce17152bd8b0340df02
SHA512

ef8837993ef02b29fd9b708627d07307c3e8cce627b6cd6f999029eb28f518496cc2b27e6606208ead62c93fc5468221966051065134999e5b1b38e8a57c2def
SSDEEP

1536:ev/5VYPO5kpVh/wdEjMc1nY/QcFv7/HYk:QThuVJvAc1Y4gv7d

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2584-0-0x0000000010000000-0x000000001000C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 2584	652	rundll32.exe	90
PID 652 wrote to memory of 2584	652	rundll32.exe	90
PID 652 wrote to memory of 2584	652	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed32980f109944f73f6f7fe180c449b6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed32980f109944f73f6f7fe180c449b6_JaffaCakes118.dll,#1
  2⤵
  PID:2584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:2916

memory/2584-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download